Exploitation & Mitigation GFACT Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An attacker gains access to a system by using a tool that captures keystrokes and steals saved passwords from the browser. Which type of tool did the attacker use?

   • ANetwork scanner
   • BExploit framework
   • CCredential harvesting tool
   • DRemote access trojan
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A company runs a legacy web application that cannot be patched immediately because the vendor has not released a fix. The application runs on a server that also hosts a database with sensitive customer data. Which mitigation strategy would most effectively reduce the risk of exploitation while the patch is pending?

   • ADisable the database service until the patch is applied.
   • BPlace the application behind a web application firewall (WAF) with rules that block known attack patterns, and restrict database access to only the application server.
   • CMove the application to a different server that has more memory.
   • DIncrease the logging level on the application server to capture all requests.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which mitigation strategy is most directly effective in preventing the exploitation of known software vulnerabilities?

   • AUsing network segmentation
   • BImplementing strong password policies
   • CConducting security awareness training
   • DRegularly applying security patches
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A penetration tester is performing an assessment of a corporate network. The tester has already identified that a web server is running an outdated version of Apache with a known remote code execution vulnerability. According to a systematic exploit methodology, what should the tester do next?

   • AImmediately run the exploit against the production server to save time.
   • BSearch for an exploit module that matches the exact Apache version and test it in a controlled environment.
   • CReport the vulnerability to the client and stop the assessment.
   • DMove on to another target because the vulnerability is already known.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A penetration tester has gained initial access to a Windows server as a standard user. The tester discovers that the server has an unpatched kernel vulnerability. However, the tester also finds that the server's security policy requires all kernel updates to be tested before deployment, and the next maintenance window is in two weeks. Which action should the tester take to escalate privileges?

   • AWait for the maintenance window to patch the server
   • BReport the vulnerability to the administrator
   • CLook for other privilege escalation vectors, such as misconfigured services
   • DExploit the kernel vulnerability immediately
   Reveal Solution Discussion Select an answer first